Better Safe Than Sorry: Constructing Byzantine-Robust Federated Learning with Synthesized Trust

Abstract

Byzantine-robust federated learning empowers the central server to acquire high-end global models amidst a restrictive set of malicious clients. The general idea of existing learning methods requires the central server to statistically analyze all local parameter (gradient or weight) updates, and to delete suspicious ones. The drawback of these approaches is that they lack a root of trust that would allow us to identify which local parameter updates are suspicious, which means that malicious clients can still disrupt the global model. The machine learning community has recently proposed a new method, FLTrust (NDSS’2021), where the server achieves robust aggregation by using a tiny, uncontaminated dataset (denoted as the root dataset) to generate the root of trust; however, the global model’s accuracy will significantly decline if the root dataset greatly deviates from the client’s dataset. To address the above problems, we propose FLEST: a Federated LEarning with Synthesized Trust method. Our method considers that trust and anomaly detection methods can complementarily solve their respective problems; therefore, we designed a new robust aggregation rule with synthesized trust scores (STS). Specifically, we propose the trust synthesizing mechanism, which can aggregate trust scores (TS) and confidence scores (CS) into STS through a dynamic trust ratio γ, and we use STS as the weight for aggregating the local parameter updates. Our experimental results demonstrated that FLEST is capable of resisting existing attacks, even when the root dataset distribution significantly differs from the total dataset distribution: for example, the global model trained by FLEST is 41% more accurate than FLTrust for adaptive attacks using the mnist-0.5 dataset with the bias probability set to 0.8.